All JWT guides
Newest first. Each one names the runtime its outputs came from.
JWT Segments: The Header Decodes Everywhere, the Payload Does Not
The 27-byte header decodes in every runtime; seven of eleven standard-library calls fail on the payload or signature of the same token.
JWT Refresh Tokens: Getting Revocation Back
The split that buys revocation back, why the refresh token should not be a JWT, and what rotation detects.
Where to Store a JWT: httpOnly Cookie vs localStorage
localStorage is readable by every script; an httpOnly cookie is not — and is sent automatically.
JWT vs Session Cookies: The Revocation Problem
43 bytes and revocable versus 324 bytes and not. The revocation problem and the refresh-token split.
How to Verify a JWT: Signature, Algorithm Pinning and Claims
Recomputing the signature, pinning the algorithm, and the claim checks that only mean something afterwards.
JWT Expiration: exp, nbf, iat and the Milliseconds Trap
The exp claim is in seconds not milliseconds, what happens without it, clock skew, and why a token cannot be extended.